#!/bin/bash
ETCD_VERSION=3.6.3
TMP_DIR=./tmp
INSTALL_DIR=/opt/k8s/bin
CONF_DIR=/opt/k8s/conf
PKI_DIR=/etc/kubernetes/pki
MASTER_HOSTS="[ \
        \"192.167.5.2\", \
        \"192.167.5.3\", \
        \"192.167.5.4\" \
      ]"

prepare(){
  echo 'Create floder'
  mkdir -p $TMP_DIR $TMP_DIR/pki ${INSTALL_DIR} ${CONF_DIR} /etc/kubernetes/manifests /var/lib/kubelet /var/lib/kube-proxy /etc/etcd /var/lib/etcd
  #cp kubernetes/server/bin/{kube-apiserver,kube-controller-manager,kube-scheduler,kubelet,kube-proxy,kubectl} /opt/k8s/bin/
  #cp bin/* /opt/k8s/bin/
  #cp runc.amd64 /opt/k8s/bin/runc
  echo "解压cfssl-tools.tar.gz:${INSTALL_DIR}";
  tar -zxvf cfssl-tools.tar.gz -C ${INSTALL_DIR} && find ${INSTALL_DIR}/cfssl* -type f -exec chmod +x {} \;


  # 配置环境变量
  echo 'export PATH=$PATH:/opt/k8s/bin' >> /etc/profile
  source /etc/profile
}
rootCA(){
  original_dir=$(pwd)
  cd ${TMP_DIR}/pki
  # 1、创建 CA 配置文件
  cat > ca-config.json <<EOF
  {
    "signing": {
      "default": {
        "expiry": "262800h"
      },
      "profiles": {
        "kubernetes": {
          "usages": ["signing", "key encipherment", "server auth", "client auth"],
          "expiry": "262800h"
        }
      }
    }
  }
EOF

  # 2、创建 CA 证书请求 (ca-csr.json)
  cat > ca-csr.json << EOF
  {
    "CN": "kubernetes",
    "key": {
      "algo": "rsa",
      "size": 2048
    },
    "names": [
      {
        "C": "CN",
        "ST": "Shanghai",
        "L": "Shanghai",
        "O": "kubernetes",
        "OU": "System"
      }
    ],
    "ca": {
      "expiry": "262800h"
    }
  }
EOF


  # 3、生成 CA 证书和私钥
  cfssl gencert -initca ca-csr.json | cfssljson -bare ca
  echo '拷贝root ca证书;cd ${original_dir}'
  cd ${original_dir}
  cp $TMP_DIR/pki/ca.pem ${PKI_DIR}/ca.pem && \
  cp $TMP_DIR/pki/ca-key.pem ${PKI_DIR}/ca-key.pem

}


installEtcd(){
  original_dir=$(pwd)
  rm -rf /var/lib/etcd
  tar -zxvf etcd-v${ETCD_VERSION}-linux-amd64.tar.gz -C ./$TMP_DIR && find ./$TMP_DIR  -type f -name "etcd*"| xargs -I {} chmod +x {}
  cp ./$TMP_DIR/etcd-v${ETCD_VERSION}-linux-amd64/{etcdctl,etcdutl,etcd} ${INSTALL_DIR}
  cd ${TMP_DIR}/pki
  cat > etcd-csr.json << EOF
  {
      "CN": "etcd",
      "hosts": ${MASTER_HOSTS},
      "key": {
          "algo": "rsa",
          "size": 2048
      },
      "names": [
          {
              "C": "CN",
              "L": "Xian",
              "ST": "Xian",
              "O": "k8s",
              "OU": "System"
          }
      ]
  }
EOF
  #会生成etcd.pem和etcd-key.pem文件
  echo "正在生产etcd服务端证书"
  cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes etcd-csr.json | cfssljson -bare etcd

  #查看证书有效期
  cfssl certinfo -cert etcd.pem |grep not
  echo '拷贝etcd ca证书'
  cd ${original_dir}
  cp $TMP_DIR/pki/etcd.pem ${PKI_DIR}/etcd.pem && \
  cp $TMP_DIR/pki/etcd-key.pem ${PKI_DIR}/etcd-key.pem


cat > ${CONF_DIR}/etcd.conf << EOF
#[Member]
ETCD_NAME="etcd-1"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://192.168.5.2:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.5.2:2379"
#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.5.2:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.5.2:2379"
ETCD_INITIAL_CLUSTER="etcd-1=https://192.168.5.2:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"
EOF

cat > /lib/systemd/system/etcd.service << EOF
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
[Service]
Type=notify
EnvironmentFile=${CONF_DIR}/etcd.conf
ExecStart=${INSTALL_DIR}/etcd \
  --cert-file=${PKI_DIR}/etcd.pem \
  --key-file=${PKI_DIR}/etcd-key.pem \
  --client-cert-auth=true \
  --trusted-ca-file=${PKI_DIR}/ca.pem \
  --peer-cert-file=${PKI_DIR}/etcd.pem \
  --peer-key-file=${PKI_DIR}/etcd-key.pem \
  --peer-client-cert-auth=true \
  --peer-trusted-ca-file=${PKI_DIR}/ca.pem
Restart=on-failure
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable etcd&&systemctl start etcd

}

prepare

rootCA

installEtcd